Ground truth is derived from the published archives through the repo's own extraction path, never from the authority. Member set, kind, and link target are already covered by the digest-pinned companion manifests, so this fixture covers only the executable bit. The offline check runs in make ci via make test, and the network-using generator is deliberately excluded from install-checks. Co-Authored-By: Codex <noreply@openai.com>